Re: [v6ops] Fwd: New Version Notification for draft-wkumari-long-headers-01.txt

[Nick Hilliard <[e-mail]>]

On 05/07/2013 15:20, Joe Touch wrote:
> Your explanation has nothing to do with that. 

In fact it has because it's still the same silicon which is used in both
circumstances.

Alternatively let's talk about infrastructure ACLs.  I also want to be able
to filter ipv6 packets with arbitrary ipv6 headers on my network edge so
that other people cannot reach my core network with known harmful traffic.
 Is that better?  Remember, it's the same silicon which does both.

> However, I can still shut
> down your router any number of ways, by sending lots of interesting things
> in those first 128 bytes that cause the router to overload - e.g.,
> fragments to reassemble, source routes to process, etc.

Eh, no, you generally can't.  Source routed packets have dropped for the
last 15 years.  Reassembly attacks can be protected by dropping packets
from everything except known hosts, and by using infrastructure acls to
stop spoofing.

>> ...All you need to know is the
>> ipv6 address of any interface on the box, and you can trivially trash it
>> remotely.
> 
> Whether that's true does not seem to depend on the header chain length, though.

God almighty, Joe, of course it depends on the header chain length.  It
depends on plenty of other things too, but header chain length is one of them.

This is a ridiculous argument:  you clearly have no operational experience
in this area, nor any clue of how modern routers operate and how their
operational limitations affect production networks.

Nick